Ask most creators how their editor posts to the channel, and the answer is a shared password in a text thread. Ask how the social media manager handles Instagram, and it is the same password, forwarded again. Ask how many people currently know it, and the room goes quiet.
Every one of those people is now a way into your business. Not because they are dishonest, but because their laptop, their phone, and their inbox are all places that password can be stolen from. You have multiplied your attack surface by the size of your team, and you have no way to see who did what.
Every major platform has solved this. The tools exist. They are just unglamorous, so nobody sets them up until after something goes wrong.
The principle
One person owns the account. Everyone else gets a role. Roles can be scoped, logged, and revoked in a click. Passwords cannot.
Meta: Facebook and Instagram
Meta’s business portfolio (what used to be called Business Manager, surfaced through Business Suite) lets you grant people access to a Facebook Page and its connected Instagram account without ever sharing a login. Each person logs in with their own Facebook account and is assigned specific permissions: create content, moderate messages and comments, view insights, run ads. Full control is a separate, deliberate grant that you should hand to almost no one.
Agencies get added as partners, not as people. That way the agency manages its own staff, and when you end the relationship you remove the agency as a whole rather than hunting down individual logins.
Turn on two-factor authentication requirements for everyone in the portfolio. Meta allows you to enforce it.
YouTube
YouTube channel permissions let you invite people by their Google account and give them one of several roles: Manager, Editor, Editor (limited), Viewer, or Viewer (limited). An Editor can upload, edit, and publish. An Editor (limited) can do all of that without seeing revenue data. A Viewer can see analytics and nothing else. Nobody but the Owner can delete the channel or change who the Owner is.
Your editor should be an Editor or Editor (limited). Your agency’s reporting person should be a Viewer. The Owner is you, on an account protected by a hardware key, and that account is not used for day-to-day uploads.
TikTok
TikTok Business Center is the equivalent structure for TikTok accounts and ad accounts. You add members, assign them an admin or standard role, and then grant them access to specific assets with specific permission levels. As with Meta, partner organizations can be attached and detached as a unit. If you are on a personal TikTok account with a team posting to it, moving to a Business Center structure is the single most useful change you can make.
Where roles do not reach
Some things still require a shared credential: a brand email inbox, a Linktree, a Shopify admin, a podcast host, a Discord server’s bot token. For those, use a password manager with shared vaults. 1Password, Bitwarden, and similar tools let you put a credential in a vault, share the vault with specific people, and revoke access later. The person uses the credential through the manager and often never sees it in plaintext. When you rotate the password, it rotates for everyone at once.
Each team member gets their own password manager account, protected by two-factor authentication. Nobody shares a master password.
Hardware keys for the people who matter
The accounts that own everything, your primary Google account, your Meta business portfolio admin, your Apple ID, should be protected by hardware security keys such as a YubiKey. A phished password or a SIM-swapped phone number does nothing against a physical key that the attacker does not hold. Buy two, register both, and keep one somewhere that is not your house. Anyone on your team with full administrative access should be on keys too.
The offboarding checklist
People leave. Contracts end. Relationships sour. The day someone’s access ends, work through this list, in this order.
- Remove their role from every platform: Meta portfolio, YouTube permissions, TikTok Business Center, and anything else with a roles page.
- Remove them from every shared vault and every shared folder.
- Rotate every password they could have seen in plaintext, even once. Assume they wrote it down.
- Sign out all active sessions on the accounts they touched. Platforms let you see and end sessions by device.
- Revoke third-party app connections they set up: scheduling tools, analytics dashboards, Zapier automations.
- Check the recovery email and phone number on every account to confirm none of them belong to the departing person.
- Check for forwarding rules and filters in any shared inbox. These are routinely used to maintain quiet access.
- Change the PIN on your wireless carrier account if they ever had it.
Write this down before you need it. It should take an afternoon, not a crisis.
What good looks like
The owner account lives on a hardware key and is rarely logged into. Every team member has a role matched to their actual job. Agencies are partners, not people. Shared credentials live in vaults, not in Notes or Slack. You can look at any platform and see exactly who has access and what they did. When someone leaves, their access ends in minutes, and nothing else has to change.
None of this slows down a team that is used to it. It just removes the quiet assumption that everyone will stay trustworthy, careful, and employed forever.
Where ShutOut comes in
ShutOut’s account hardening engagements set this structure up with you and your team: role audits across every platform, shared vault design, hardware key deployment, and an offboarding runbook written for your specific setup. We then monitor the accounts for session anomalies and unauthorized changes, so when something does slip, you hear about it from us before you hear about it from your audience.